Operates a social platform, in the Netherlands

Auteurswet, artt. 29c-29e · Read the law's page

• These rules reach a provider of an information society service whose main purpose, or one of whose main purposes, is to store and give the public access to a large amount of works uploaded by its users, which it organizes and promotes for profit. They do not reach non-profit online encyclopedias, non-profit educational or scientific databases, platforms for developing and sharing open-source software, providers of electronic communications services, online marketplaces, business-to-business cloud services or cloud services that let users store information for their own use.
• Seek authorization from the makers or their successors in title for the works your users upload to your service. Where you obtain it, it also covers your users' communication to the public, except users who act on a commercial basis or whose activity generates significant income.
• If you have no authorization, make best efforts to obtain it, make best efforts, in line with high industry standards of professional diligence, to keep unavailable the specific works for which rightholders gave you relevant and necessary information, and, on receiving a sufficiently substantiated notice from a maker or successor in title, quickly remove the notified work from your website or disable access to it and make best efforts to prevent the notified works from being offered again in the future. You are liable for infringement of the right of communication to the public unless you can show all three.
• On request, give makers or their successors in title adequate information about the use of works for which you obtained authorization, and about the measures you have taken to meet the best-efforts and notice duties and how they are carried out.
• Tell your users in your terms and conditions about the limitations on copyright, and do not let your cooperation with rightholders prevent the availability of user-uploaded works that do not infringe copyright, including works whose use falls under a limitation.
• Set up a complaint procedure through which users can complain about how the best-efforts and notice duties are applied, give an effective, quick decision that is subject to human review after hearing the rightholder concerned, and arrange that rightholders and users can appeal to an impartial dispute committee that gives an effective, quick decision subject to human review.
• If you have offered your service in the Union or the European Economic Area for less than three years and have annual turnover below EUR 10 million, you are not liable if you show best efforts to obtain authorization and quick removal of a notified work on a sufficiently substantiated notice. If your average monthly unique visitors, calculated on the previous calendar year, exceed 5 million, you must also show best efforts to prevent notified works from being offered again.
• Do not rely on the hosting exemption in Article 6(1) of the Digital Services Act for works you communicate to the public on the conditions of Articles 29c and 29d.

Uitvoeringswet digitaledienstenverordening, arts. 2.1-2.9 and 3.1-3.7 · Read the law's page

• Comply with the Digital Services Act articles that Article 2.2(1) of the Uitvoeringswet digitaledienstenverordening places under the supervision and enforcement powers of the Authority for Consumers and Markets (ACM): Articles 9(1) and (5), 10(1) and (5), 11, 12, 13(1), (2) and (4), 14, 15(1), 16(1), (2), (4), (5) and (6), 17(1), (3) and (4), 18, 20(1), (3), (4), (5) and (6), 21(1) (second subparagraph), 21(2) (first subparagraph), 21(4) and (5), 22(1), (3) and (6) (first sentence), 23, 24(1), (2), (3) and (5), 25(1), 26(1) and (2), 28(1), 30, 31 and 32.
• Comply with Articles 26(3), 27 and 28(2) of the Digital Services Act, which Article 3.2(1) places under the supervision and enforcement powers of the Data Protection Authority (Autoriteit persoonsgegevens, AP).
• Act in accordance with an independent order (zelfstandige last) that the ACM imposes on you under Article 2.5(1), in the form of an interim measure under Article 51(2)(e) of the Digital Services Act or a measure under Article 51(3)(a) or (b), or that the AP imposes on you under Article 3.6(2), in the form of an interim measure under Article 51(2)(e) or a measure under Article 51(3)(a). An ACM order under Article 2.5(1)(c) needs the prior authorization of the examining judge.
• If the AP has declared a commitment of yours binding under Article 3.5, act in accordance with that decision.

Cyberbeveiligingswet, Artt. 21 en 24 · Read the law's page

• Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems you use for your work or to provide your services, and to prevent an incident or limit its effect on the recipients of your services and on other services.
• Cover at minimum: risk analysis and information-system security policy; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including the direct suppliers and service providers you rely on; security in acquiring, developing and maintaining your systems, including vulnerability handling and disclosure; policies to assess the effectiveness of your risk-management measures; basic cyber-hygiene practices and staff training; cryptography and, where applicable, encryption policy; personnel security, access control and asset management; and, where appropriate, multi-factor or continuous authentication, and secure voice, video, text and emergency communications.
• Have your management board approve these measures, and ensure every board member holds the knowledge and skills to identify network-and-information-system risks, assess your cybersecurity risk-management measures, and assess their consequences for your services, within two years of this duty taking effect or, for a member appointed afterwards, within two years of appointment.
• This binds an essential entity (Article 8 or 9) or an important entity (Article 12 or 13) drawn from Annex 1 or Annex 2; Annex 2's digital-provider entry names an online marketplace, an online search engine and a social-networking-services platform, and Annex 1's digital-infrastructure and ICT-service-management entries separately name a cloud-computing-service provider, a data-centre-service provider and a content-delivery-network provider, so a service in any of those six lines is reached at the medium-enterprise size threshold or above; the wider sector classes (energy, transport, banking, health, drinking water, public administration and the rest of the Annexes) are reached too, by declaring that you are an essential or important entity. A financial entity covered by Regulation (EU) 2022/2554 answers under that Regulation instead, because Article 22 sets this Article aside where a sector-specific act of the European Union is at least equivalent.

Cyberbeveiligingswet, Artt. 25-29 · Read the law's page

• This binds an essential entity (Article 8 or 9) or an important entity (Article 12 or 13) drawn from Annex 1 or Annex 2, on the same scope as this jurisdiction's companion risk-management row: Annex 2's digital-provider entry names an online marketplace, an online search engine and a social-networking-services platform, and Annex 1 separately names a cloud-computing-service provider, a data-centre-service provider and a content-delivery-network provider, each at the medium-enterprise size threshold or above; the wider sector classes are reached as on that row. A financial entity covered by Regulation (EU) 2022/2554 reports under that Regulation instead, because Article 31 sets Articles 25 to 30 aside where a sector-specific act of the European Union is at least equivalent.
• Give your CSIRT and competent authority an early warning without delay, or within 24 hours of becoming aware of a significant incident if immediate reporting is not possible, stating whether the incident is suspected to result from unlawful or malicious action and whether it may have cross-border effects.
• Follow with a notification, without delay or, if that is not possible, within 72 hours of becoming aware of the significant incident, updating the early warning with an initial assessment of the incident's severity and effects. If you provide a trust service and the incident affects its provision, file this notification without delay or, if that is not possible, within 24 hours of becoming aware of the incident instead.
• Submit an interim report if your CSIRT or competent authority asks for one.
• Submit a final report no later than one month after your notification, describing the incident in detail, its severity and effects, the likely threat or root cause, mitigating measures applied, and any cross-border effects; if the incident is still ongoing at that point, submit a progress report instead and the final report within one month of resolution.
• Where appropriate, inform the recipients of your service of the incident and of any measures they can take in response (Article 30).

Implementatiewet richtlijn herziening productaansprakelijkheid, Kamerstuk 36906 · Read the law's page

• The bill excludes free-of-charge and open-source software (gratis en opensourcesoftware) that you develop or supply outside the course of a commercial activity (Art. 6:184a(3)(a)).
• If you develop, manufacture or produce a product, software included, or present yourself as its manufacturer by putting your name or trade mark on it, you answer as its manufacturer for damage a defect in it causes (Arts. 6:184a(1)(b) and (e), 6:187(1)(a)).
• Keep supplying the software updates and upgrades needed to maintain safety while the product is within your control: a defect due to software, a related service or a missing safety update is not excused because it arose after you placed the product on the market (Art. 6:185(2)).
• Meet the product safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in deciding whether it is defective (Art. 6:186(1)(f)), and failing a mandatory requirement that protects against the damage suffered presumes it defective (Art. 6:188(2)(b)).
• Account for what your product learns or acquires after release: the effect of any ability to keep learning or to acquire new features is weighed in deciding whether it is defective (Art. 6:186(1)(e)).
• Be ready to give access to the relevant evidence you hold when a court orders it under Articles 194 and 195 of the Code of Civil Procedure; failing to do so presumes the product defective (Art. 6:188(2)(a)).
• If you manufacture outside the Union, the importer, your authorized representative or, where neither is established in the Union, the fulfillment service provider answers for the product alongside you (Art. 6:187(1)(c)).
• If you substantially modify a product outside its manufacturer's control and then place it on the market or put it into service, you are treated as its manufacturer (Art. 6:187(2)).
• If you distribute a product, or provide an online platform that lets consumers conclude distance contracts with traders, name the liable operator established in the Union or your own supplier within one month of the injured person's request, or you answer for the defective product (Art. 6:187(3) and (4)).
• Be able to show when you placed the product on the market or put it into service: you are not liable if you did not, or if it is plausible that the defect did not exist then (Art. 6:185(1)(a) and (c)).